All they had to do was add a simple display for address verification.

This shit isn't hard & there's no way to confirm an internet connected device, in this case your computer broadcasting the signed transaction, is compromised or not.